With popularization of the Internet, higher network security is required. Loopholes are frequently used for launching attacks. The time from discovery to use of a security loophole is now shortened from a few months to a few days. Once a loophole is discovered, it is used for launching attacks shortly. For such attacks, it usually takes a long time for the vendor to obtain a sample of malicious codes, and it is slower to release the corresponding patches. Therefore, such attacks tend to cause huge damages. MS Blast was used for launching attacks hardly in less than 25 days after it was discovered, and Nachi (a variant of MS Blast) was used for launching attacks in less than one week after it was discovered. If the malicious codes are discovered early, the attacks can be prevented in time, and the loss caused by malicious codes will be reduced.
In the prior art, network devices are unable to report suspicious codes. After the malicious code attack is launched, it takes a long time for the vendor to obtain the malicious code sample. Antivirus software analyzes files downloaded to the computer and reports the analysis result to the monitoring center. However, the computer may still be attacked by downloaded malicious codes if the downloaded data is not treated properly, which brings a heavy burden onto the computer. Antivirus software has to be installed on the computer, which is troublesome to the user. For such reasons, some users refuse to install antivirus software on network devices so that such devices are more vulnerable to propagation of malicious codes.